One- Way Entangled-Photon Autocompensating Quantum Cryptography 
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A new quantum cryptography implementation is presented that uses entanglement to combine 
one-way operation with an autocompensating feature that has hitherto only been available in im- 
plementations that require the signal to make a round trip between the users. Using the concept of 
advanced waves, it is shown that this new implementation is related to the round-trip implementa- 
tion in the same way that Ekert's two-particle scheme is related to the original one-particle scheme of 
Bennett and Brassard. The practical advantages and disadvantages of the proposed implementation 
are discussed in the context of existing schemes. 
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The idea of using quantum systems for secure commu- 
nications originated in the 1970s with Stephen Wiesner's 
intuition that the uncertainty principle, commonly de- 
rided as a source of noise, could be harnessed to detect 
unauthorized monitoring of a communication channel 1] . 
The first quantum cryptographic protocol (BB84) was 
published by Charles H. Bennett and Giles Brassard in 
1984 (21 • While rigorous proofs of the security of BB84 
under realistic conditions have only recently emerged (cf. 
Ref. [3| and references therein), the "no-cloning theo- 
rem" 4| published in 1982 provides a one-line security 
proof applicable in ideal circumstances. Given the obvi- 
ous choice of light as a signal carrier, the path to prac- 
tical quantum cryptography was clear: develop robust 
experimental methods to create, manipulate, transmit, 
and detect single photons. For an excellent summary of 
progress in the theory and practice of quantum cryptog- 
raphy, see Ref. 

The nascent field of quantum cryptography took an 
unexpected turn in 1992 when Artur Ekert published a 
new protocol that derived its security not from the 
impossibility of cloning a quantum state, but rather the 
seemingly distinct phenomenon of the violation of Bell's 
inequality Q- The practical importance of this scheme 
was immediately questioned by Bennett et al. Q They 
pointed out that the same hardware required for Ekert's 
protocol could be used to implement the more efficient 
BB84 protocol. This is accomplished by regarding the 
two-particle source together with one detection appara- 
tus as a single entity that produces a localized quantum 
state (i.e., one of the four BB84 polarization states) to 
be detected by the other detection apparatus. Although 
not described as such, their objection amounted to an 
application of the concept of advanced waves [!j . This 
method, pioneered by David Klyshko, establishes a for- 
mal equivalence between two optical constructs: 1) the 
propagation of two entangled photons from a localized 
source to a pair of remote detectors, and 2) the prop- 
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agation of a single photon from one detector backwards 
towards the source, where it is reflected, and then forward 
to the other detector. The advanced- wave method is a 
powerful tool for developing intuition about two-photon 
interference experiments that demonstrate entanglement 
in time 0] > space , and, trivially, polarization. For a 
discussion of apparent backward-in-time processes in the 
more general context of quantum information theory, see 
Ref. PJ. 

The strong interest in absolutely secure communica- 
tions has fueled an ongoing effort to determine which 
protocol leads to the best performance in practical imple- 
mentations. In 1997, Muller ct al. introduced autocom- 
pensating quantum cryptography (AQC), in which the 
optical signal makes a round trip between the legitimate 
users (commonly referred to as Alice and Bob) [R| • The 
scheme is described as autocompensating since it pro- 
vides high-visibility interference without an initial cali- 
bration step or active compensation of drift in the optical 
apparatus; these favorable properties led the authors to 
refer to their scheme informally as "plug-and-play quan- 
tum cryptography. " While this scheme and its refine- 
ments [Tj, UH Ufa Ell represent substantial progress 
in the quest for a practical quantum cryptography imple- 
mentation, the requirement that the signal travel both 
directions along the transmission line leads to non-trivial 
technical difficulties. 

In this article, we describe one-way entangled-photon 
autocompensating quantum cryptography (OW-AQC) in 
which two photons travel one way (e.g., from Alice to 
Bob), instead of one photon traveling back and forth, as 
in AQC. The formal association of OW-AQC with AQC 
follows directly from the advanced-wave view, just as Ek- 
ert's scheme follows from BB84. While Ekert's scheme 
employs entanglement to allow an alternative space-time 
configuration (signal source between Alice and Bob ver- 
sus a source on Alice's side), OW-AQC employs entangle- 
ment to achieve immunity to interferometer drift within 
the original paradigm of a one-way quantum channel 
from Alice to Bob. Thus, our result provides a new ex- 
ample of a capability afforded by quantum entanglement. 

This article is organized as follows. First, we briefly 
review the standard AQC scheme. Second, we introduce 
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FIG. 1: A) and C) depict schematics for AQC and OW-AQC, 
respectively. L is a source of laser pulses, S emits the two- 
photon entangled state |$) described by Eq. C is a cir- 
culator, AT is an attenuator, PM is a phase modulator, and 
(D, D e , D;) are detectors. B) and D) depict the associated 
space-time diagrams which indicate how the interference con- 
dition between the two amplitudes is controlled by both Alice 
and Bob. The dotted space-time traces in B) are used in 
the text to explain the relationship between the two meth- 
ods from the viewpoint of advanced waves. In D), the four 
rectangles at the point z = Zn correspond to the four time 
intervals labeled at z = za and z — zb- The unshaded boxes 
indicate the two time intervals during which Bob's detector is 
activated. The solid and dashed space-time traces depict two 
interfering two-photon amplitudes, as described in the text. 



OW-AQC and show that it combines one-way operation 
with the insensitivity to drift that is characteristic of its 
predecessor. Third, we point out the formal equivalence 
of the two methods from the advanced-wave viewpoint 
using space-time diagrams. Finally, we discuss the rela- 
tive merits of OW-AQC. 

Figure contains a schematic of AQC. The protocol 
begins with Bob launching a strong pulse from a laser 
(L) into a Mach-Zehnder interferometer via a circulator 
(C). This interferometer splits the pulse into an advanced 
amplitude (PI) and a retarded amplitude (P2). The am- 
plitudes travel through phase modulators (PM) on Bob's 
side and Alice's side, and are then attenuated (AT) to the 
single photon level and reflected by Alice back to Bob. 
Although both PI and P2 will again be split at Bob's 
Mach-Zehnder interferometer, by gating his detector ap- 
propriately, Bob can postselect those cases in which PI 
takes the long path and P2 takes the short path on the 



return trip. Thus, the interfering amplitudes experience 
identical delays on their round trip, ensuring insensitivity 
to drift in Bob's interferometer. 

The role of the phase modulators can be readily un- 
derstood by examining the space-time diagram of this 
protocol (see Fig.[Tp). The eight boxes (A1-A4, B1-B4) 
refer to the phase settings on the two modulators as the 
two amplitudes pass through each of them twice. For 
example, B2 refers to the phase acquired by the delayed 
amplitude of the pulse that Bob sends to Alice, while B4 
refers to the phase acquired by the same amplitude as it 
travels back from Alice to Bob. It should be understood 
that B1-B4 refer to settings of the same physical phase 
shifter at different times (and similarly for A1-A4). The 
probability of a detection at Bob's detector is given by 



P d ocl 



cos[(B2 - Bl) + (A2 - Al) 
(A4- A3) + (B4-B3)]. 



(1) 



From this expression we see that only the relative phase 
between the phase modulator settings affects the prob- 
ability of detection. Thus, by setting Bl = B2 and 
Al = A2, Alice and Bob can implement the interfero- 
metric version of BB84 by encoding their cryptographic 
key in the difference settings A<pA = A4 — A3 and 
Acj>B = B4 — B3. Since the resulting expression 



P d ocl 



cos(A()) A + A(/)b) 



(2) 



is independent of the time delay in Bob's interferometer 
and the absolute phase settings in either modulator, Alice 
and Bob are able to achieve high-visibility interference 
without initial calibration or active compensation of drift. 

Figure^- contains a schematic of OW-AQC. Alice's 
source (S) produces a specific two-photon state which is 
transmitted to Bob and analyzed with a Mach-Zehnder 
interferometer and a single detector that is activated 
for two distinct time intervals. As in AQC, Alice and 
Bob change the settings of their respective phase mod- 
ulators at specific time intervals in order to implement 
BB84. The two-photon state that Alice sends to Bob 
consists of an early photon (which is emitted from Al- 
ice's source in the time interval t e G [— 2T, 0]) and 
a late photon (which is emitted in the time interval 
ti G [0, IT]). The joint emission times of the early 
photon and the late photon are described by the state 
|*} = J7 dt e dti f(t e ,ti) \t e ) \t t ), where 



S(t e 




tl) 



-2T < t e < 
otherwise. 



(3) 



This particular entangled state entails perfect anti- 
correlation in the time of emission of the two pho- 
tons; thus, while the difference in emission time of 
the two photons is uniformly distributed over the in- 
terval [0,4T], the sum of the emission times is fixed 
at t = for each emitted pair. By Fourier duality, 
the two photons are correlated in frequency. While 
the typical configurations for practical sources of entan- 
gled photon pairs produce frequency anti-correlation, the 
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frequence-correlated case has been discussed in several 
papers [H El El El El E| 

Figure ^3 presents a space-time diagram of the OW- 
AQC protocol. The two-photon entangled state is sent 
through Alice's phase modulator at position z = za 
where she sets the phase shifts (A1-A4) for the four time 
intervals indicated in the diagram. Next, the two-photon 
state is transmitted along the channel to Bob, where it is 
sent through Bob's phase modulator [z — zb). A Mach- 
Zehnder interferometer (z — Zm) then delays a portion 
of the radiation by a time r. Finally, Bob's detector 
[z = zd) is activated for two time intervals of length T 
that correspond to the second halves of the early and 
late photon wave packets. Gating Bob's detector in this 
way postselects the cases in which the advanced (delayed) 
portion of each photon takes the long (short) path. This 
postselection reduces the photon flux by half and obvi- 
ates the need for rapid switching of optical paths. Since 
the time intervals are non-overlapping, we may consider 
that Bob is using two detectors that are distinguished by 
the ordering of their respective time windows. Thus, for 



the rest of the letter, we refer to two detectors on Bob's 
side, D e and D/, which correspond respectively to the 
early and late activation intervals of Bob's single physi- 
cal detector. 

The two-photon interference can be seen by examin- 
ing the space-time trajectories of two specific two-photon 
amplitudes. In Fig.^3, the solid space-time traces entail 
emission times (t e ,ti) = (— 3T/2,3T/2) and the dashed 
traces entail emission times (t e ,ti) — (— T/2,T/2). For 
delay t = T, the portion of the solid and dashed am- 
plitudes leading to a coincidence are indistinguishable 
after Bob's Mach-Zehnder interferometer. This indis- 
tinguishability brings about quantum interference that 
varies continuously between completely constructive and 
completely destructive, depending on the joint phase set- 
tings A1-A4, B1-B4. 

By activating detectors D e and D; for a duration T at 
times — — T and — + T, respectively, Bob establishes 
the following relation between the electric-field operators 
E e j at his detectors and the annihilation operator a(t) 
associated with \t), 



E e (h) oc { e< A2+B2 h( tl - if. - t) + e ! ( A1+B1 )a(< 1 - S?) -T < t x - ^ < (4) 

\ otherwise 

E,(U) oc ! e* (A3+B3) «(*2 - -r) + e l ( A4+B4 )a(< 2 - T < t 2 - ^ < 2T 

y ' I otherwise, V ; 



where r is the delay in Bob's Mach-Zehnder interfer- 
ometer, and c is the speed of light. Substituting into 
the expression for the probability of a coincidence Pq oc 
/ J dtidfr \(0\E e (ti)Ei(t 2 )\^)\ 2 , we obtain 



Pc oc A 
1 

+ 2 



T 



T 



A 



[1 + COS (A(j)A 

T/2" 



T/2 



A 



3T/2\ 



T/2 



, (6) 



where A(z) = 1 — |x| for — 1 < x < 1 and otherwise. 
When t = T, this equation reduces to the expression 
for the probability of detection in AQC [see Eq. (J2J]. 
To implement the interferometric version of BB84, Al- 
ice and Bob hold the settings of their respective phase 
modulators constant for the first two time intervals de- 
picted in Fig. [Tp (i.e., Al = A2 and Bl = B2), and 
manipulate the difference terms, A(j>A = A4 — A3 and 
A(/)b = B4 — B3. The crucial point is that the inter- 
ference condition is independent of the absolute setting 
or drift in either of the phase modulators. This demon- 
strates that OW-AQC achieves the insensitivity to abso- 
lute phase settings characteristic of AQC, while requiring 
only one pass through the optical system. 

It is instructive to compare the space-time diagrams in 
Figs.^3 and^D. Reflecting the dotted traces in Fig.^3 



around the line t — results in the exact space-time ar- 
rangement of Fig.^3. This construction also provides a 
clear explanation of why the two-photon state described 
by Eq. @ is chosen to possess frequency correlation in- 
stead of the more common frequency anti-correlation. A 
device that creates pairs of photons with coincident fre- 
quencies (S in Fig. ^3) is nothing more than a mirror (as 
required by Fig. ^3) when analyzed from the advanced- 
wave viewpoint. Thus, Klyshko's advanced-wave inter- 
pretation provides an intuitive justification for the equiv- 
alence between the probability of single-photon detection 
[Eq. J2J] an d the probability of two-photon coincidence 
[Eq. (JHJ] with respect to the phase modulator settings 
A1-A4 and B1-B4. 

Here we provide a qualitative comparison of AQC and 
OW-AQC. While AQC requires that only one photon 
travel the distance between Alice and Bob after Alice 
attenuates Bob's signal to the single-photon level, OW- 
AQC requires that two photons travel the same distance. 
Thus, the loss incurred in OW-AQC is approximately 
twice that of AQC for the same distance. However, the 
use of a strong pulse on the first leg of the round trip in 
AQC also contributes to a disadvantage relative to OW- 
AQC. Specifically, backscattered light from the strong 
pulse is guided directly into Bob's detectors and can lead 
to unacceptably high bit-error rates. Another advan- 
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tage of OW-AQC is immunity from the "Trojan horse 
attack" |5j, in which Eve sends an optical signal into 
Alice's lab and measures the state of the reflected light 
in order to infer the setting of Alice's phase modulator. 
While an optical isolator can subvert this attack in the 
case of OW-AQC, the bidirectional flow of optical signals 
in AQC prevents this defence. In AQC, the probability of 
detection is independent of the delay r in Bob's interfer- 
ometer [see Eq. while in OW-AQC, the interference 
condition is independent of t, but the visibility of this 
interference is not [see Eq. ©]. Thus, while drift in the 
absolute values of the phase modulations will not affect 
the performance of OW-AQC, drift in the optical delay 
must be minimized to maintain high-visibility interfer- 
ence. 

It is important to note that OW-AQC requires 
the frequency-correlated two-photon entangled state de- 
scribed in Eq . ©. This state has been investigated the- 
oretically , and several experimental methods for cre- 
ating the state have been proposed [U IH E2, 
However, the state has not yet been experimentally 
demonstrated. While frequency-anticorrelated photon 
pairs are naturally generated when a monochromatic 
pump beam impinges on a nonlinear crystal, frequency- 
correlated photon pairs are only generated when a broad- 
band pump is used, and constraints on the phase and 
group velocities of the pump, signal, and idler are sat- 
isfied. These constraints can be satisfied in a collincar 
setup by exploiting the birefringence of the nonlinear 
crystal [23. |21| | . Enhanced flexibility in satisfying these 
constraints can be achieved by imposing a periodic mod- 
ulation of the crystal's nonlinear coefficient [2j|. A 
second approach to satisfying these constraints is to 
exploit the inherent symmetry of a configuration in 
which a nonlinear waveguide is pumped at normal inci- 



dence such that the down-converted photons are counter- 
propagating |24[ • The advantage of this method is that 
frequency-correlated photon pairs can be generated re- 
gardless of the dispersion characteristics of the nonlinear 
material. 

In summary, we have described a new quantum cryp- 
tography implementation that exploits quantum entan- 
glement to achieve the favorable stability of AQC without 
requiring a round trip between Alice and Bob. This work 
represents the first demonstration that quantum entan- 
glement can offer practical advantages with respect to 
noise in quantum cryptography implementations. The 
next step in evaluating the promise of this approach for 
practical quantum cryptography involves explicit exper- 
imental proposals for creating the source described by 
Eq. and quantitative performance analysis. 

Both this work and Ekert's landmark paper Q link- 
ing quantum cryptography and Bell's theorem describe 
two-photon interference effects that employ novel space- 
time configurations to perform tasks previously achieved 
with single-photon interference. These constructions can 
be seen as applications of Klyshko's theory of advanced 
waves, which provides a formal equivalence of one- and 
two-photon interference experiments. 
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